Abnormal behavior prediction method and device, equipment, storage medium and program product

Abstract

The invention discloses an abnormal behavior prediction method and device, equipment, a storage medium and a program product. Acquiring a plurality of index data associated with the to-be-tested object; selecting a plurality of pieces of first index data which are the same as indexes corresponding to each piece of sample index data in a pre-constructed sample index data table from the plurality of pieces of index data; calling a pre-trained abnormal behavior prediction model, and obtaining an abnormal behavior prediction result corresponding to the to-be-tested object based on the plurality of pieces of first index data; wherein the sample index data table is constructed by analyzing a plurality of pieces of sample index data associated with the plurality of sample objects respectively; the abnormal behavior prediction model is constructed and trained based on a plurality of target sample index data corresponding to a plurality of sample objects included in the sample index data table by adopting a feature segmentation mode. By adopting the method, the accuracy of abnormal behavior prediction can be improved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to an abnormal behavior prediction method, apparatus, device, storage medium, and program product. Background Art

[0002] In recent years, to maintain public order and morality, and to safeguard citizens' lives, researchers have begun predicting citizens' abnormal behavior. This allows them to promptly identify individuals who are potentially engaging in abnormal behavior and, in turn, prevent such behavior. Currently, the Naive Bayesian model is the primary method used to predict abnormal behavior among key individuals. However, this method has a relatively low accuracy.

[0003] Therefore, how to improve the accuracy of abnormal behavior prediction has become an urgent problem to be solved. Summary of the Invention

[0004] The embodiments of the present application provide an abnormal behavior prediction method, apparatus, device, storage medium, and program product, which can improve the accuracy of abnormal behavior prediction.

[0005] In a first aspect, the present application provides a method for predicting abnormal behavior, the method comprising:

[0006] Obtain multiple indicator data associated with the object to be measured;

[0007] Selecting, from the plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table;

[0008] Calling a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data;

[0009] Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data associated with multiple sample objects respectively; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation method.

[0010] In this embodiment, the computer device may first obtain multiple indicator data associated with the object to be measured, and then select multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in a pre-constructed sample indicator data table from the multiple indicator data. Finally, the pre-trained abnormal behavior prediction model is called to obtain the abnormal behavior prediction result corresponding to the object to be measured based on the multiple first indicator data; wherein, the sample indicator data table is constructed by analyzing multiple sample indicator data respectively associated with multiple sample objects, and the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table in a feature segmentation manner. In this way, on the one hand, since the abnormal behavior prediction model is trained using the data in the sample indicator data table, the computer device selects multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in the sample indicator data table from the multiple indicator data associated with the object to be measured, which can ensure the consistency of the indicator data input into the pre-trained abnormal behavior prediction model and the indicator data input into the abnormal behavior prediction model during the training process, thereby helping to improve the accuracy of the abnormal behavior prediction results for the object to be measured; on the other hand, since the multiple first indicator data are associated with the object to be measured, and there is a correlation between the multiple first indicator data, in addition, the abnormal behavior prediction model is constructed using feature segmentation, which does not need to rely on the data distribution assumption of the input data. Therefore, compared with the method of using the naive Bayes model to predict abnormal behavior, the computer device calls the pre-trained abnormal behavior prediction model to process the multiple first indicator data, so that the abnormal behavior prediction model can better learn the correlation features between the multiple first indicator data, thereby further improving the accuracy of abnormal behavior prediction.

[0011] In one embodiment, the method further includes: obtaining a plurality of sample indicator data respectively associated with a plurality of sample objects; for the plurality of sample indicator data associated with each sample object, selecting a plurality of candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the plurality of sample indicator data; performing membership division on the plurality of candidate sample indicators to obtain a membership value corresponding to each candidate sample indicator, and determining a plurality of target sample indicators from the plurality of candidate sample indicators based on the membership value corresponding to each candidate sample indicator; performing standardization on a plurality of target sample indicator data corresponding to the plurality of target sample indicators to obtain a plurality of standard sample indicator data; and constructing a sample indicator data table based on the plurality of standard sample indicator data corresponding to each sample object.

[0012] In this embodiment, the computer device may first obtain multiple sample indicator data associated with multiple sample objects. Then, for each sample object, the computer device may select multiple candidate sample indicators from the indicators corresponding to the multiple sample indicator data for abnormal behavior prediction. Then, the computer device may determine a membership value corresponding to each candidate sample and determine multiple target sample indicators from the multiple candidate sample indicators based on the membership value corresponding to each candidate sample. Then, the computer device may perform a normalization process on the multiple target sample indicators. Finally, the computer device may construct a sample indicator data table using the multiple normalized target sample indicator data corresponding to each sample object. In this way, since abnormal behavior prediction is a highly subjective judgment and decision-making problem, and membership functions are suitable for highly subjective decision-making problems, especially those requiring expert experience or qualitative judgment, where membership functions can directly handle fuzziness and uncertainty and quantify imprecise information through fuzzy mathematics, the computer device may determine multiple target sample indicators from the multiple candidate sample indicators that are more consistent with subsequent abnormal behavior prediction based on the membership value corresponding to each candidate sample. This facilitates the construction of the sample indicator data table and, in turn, facilitates the subsequent development of an abnormal behavior prediction model that is more suitable for abnormal behavior prediction.

[0013] In one embodiment, based on the membership value corresponding to each candidate sample indicator, multiple target sample indicators are determined from multiple candidate sample indicators, including: using the hierarchical analysis method to determine the initial weight corresponding to each candidate sample indicator; for each candidate sample indicator, based on the initial weight and membership value corresponding to the candidate sample indicator, determining the standard weighted weight corresponding to the candidate sample indicator; from the multiple candidate sample indicators, selecting multiple candidate sample indicators whose standard weighted weight is greater than a preset standard weighted weight threshold as multiple target sample indicators.

[0014] In this embodiment, since the hierarchical analysis method can ensure the logical rationality of expert judgment and reduce subjective bias through consistency testing, the computer device can use the hierarchical analysis method to more accurately determine the initial weight corresponding to each candidate sample indicator. Then, based on the initial weight and membership value corresponding to each candidate sample indicator, the standard weighted weight of each candidate sample indicator can be more accurately determined. This allows the computer device to select multiple target sample indicators that are more consistent with subsequent abnormal behavior predictions from multiple candidate sample indicators based on the standard weighted weights corresponding to each candidate sample indicator.

[0015] In one embodiment, for multiple sample indicator data associated with each sample object, multiple candidate sample indicators for abnormal behavior prediction are selected from the indicators respectively corresponding to the multiple sample indicator data, including: for multiple sample indicator data associated with each sample object, based on the association parameters corresponding to the abnormal behavior to be predicted, multiple candidate sample indicators for abnormal behavior prediction are selected from the indicators respectively corresponding to the multiple sample indicator data.

[0016] In this embodiment, the computer device can select multiple candidate sample indicators for abnormal behavior prediction from multiple sample indicator data associated with each sample object based on the associated parameters corresponding to the abnormal behavior to be predicted. This can reduce the amount of data that needs to be processed subsequently, thereby helping to improve the efficiency of subsequent training of the abnormal behavior prediction model.

[0017] In one embodiment, the number of sample objects is N, where N is a positive integer; the method further includes: determining a weighted Gini coefficient of an indicator corresponding to each target sample indicator data based on multiple target sample indicator data corresponding to X sample objects, where X is a positive integer less than N; constructing a decision tree model based on the weighted Gini coefficient of each indicator; training the decision tree model based on each target sample indicator data to obtain a trained decision tree model; testing the trained decision tree model based on multiple target sample indicator data corresponding to Y sample objects, and using the tested decision tree model as an abnormal behavior prediction model if the test result indicates that the test passed; wherein Y+X=N.

[0018] In this embodiment, the computer device trains and verifies the abnormal behavior prediction model based on multiple target sample indicator data corresponding to each sample object in the sample indicator data table. In this way, an abnormal behavior prediction model with better performance can be obtained, which is conducive to improving the prediction accuracy when the trained abnormal behavior prediction model is used to predict abnormal behavior of the object to be tested.

[0019] In one embodiment, a pre-trained abnormal behavior prediction model is called to obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data, including: standardizing the multiple first indicator data respectively to obtain multiple second indicator data; inputting the multiple second indicator data into the pre-trained abnormal behavior prediction model to obtain the abnormal behavior prediction result corresponding to the object to be tested.

[0020] In this embodiment, since the abnormal behavior prediction model is trained using the data in the sample indicator data table, and the data in the sample indicator data table is obtained after standardization processing, the computer device obtains multiple second indicator data by standardizing multiple first indicator data respectively, and inputs the multiple second indicator data into the pre-trained abnormal behavior prediction model. In this way, the consistency of the format or structure of the data input into the abnormal behavior prediction model during actual application and the data input into the abnormal behavior prediction model during training can be ensured, thereby helping to improve the accuracy of the abnormal behavior prediction results corresponding to the object to be tested.

[0021] In a second aspect, the present application further provides an abnormal behavior prediction device, comprising:

[0022] An acquisition module, used to acquire multiple indicator data associated with the object to be measured;

[0023] A selection module is used to select, from a plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table;

[0024] A prediction module is used to call a pre-trained abnormal behavior prediction model and obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data;

[0025] Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data associated with multiple sample objects respectively; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation method.

[0026] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0027] Obtain multiple indicator data associated with the object to be measured;

[0028] Selecting, from the plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table;

[0029] Calling a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data;

[0030] Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data associated with multiple sample objects respectively; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation method.

[0031] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0032] Obtain multiple indicator data associated with the object to be measured;

[0033] Selecting, from the plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table;

[0034] Calling a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data;

[0035] Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data associated with multiple sample objects respectively; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation method.

[0036] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0037] Obtain multiple indicator data associated with the object to be measured;

[0038] Selecting, from the plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table;

[0039] Calling a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data;

[0040] Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data associated with multiple sample objects respectively; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation method.

[0041] In the abnormal behavior prediction method, apparatus, computer equipment, computer-readable storage medium, and computer program product provided by the present application, the computer equipment may first obtain a plurality of indicator data associated with the object to be measured, and then select a plurality of first indicator data that are identical to the indicators corresponding to each sample indicator data in a pre-constructed sample indicator data table from the plurality of indicator data, and finally, call a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be measured based on the plurality of first indicator data; wherein, the sample indicator data table is constructed by analyzing a plurality of sample indicator data respectively associated with a plurality of sample objects, and the abnormal behavior prediction model is constructed and trained based on a plurality of target sample indicator data respectively corresponding to a plurality of sample objects included in the sample indicator data table, using a feature segmentation method. According to this method, on the one hand, since the abnormal behavior prediction model is trained using data in the sample indicator data table, the computer device selects multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in the sample indicator data table from multiple indicator data associated with the object to be measured, which can ensure the consistency of the indicators input into the pre-trained abnormal behavior prediction model and the indicator data input into the abnormal behavior prediction model during the training process, thereby helping to improve the accuracy of the abnormal behavior prediction results for the object to be measured; on the other hand, since multiple first indicator data are associated with the object to be measured and there is a correlation between the multiple first indicator data, in addition, the abnormal behavior prediction model is constructed by feature segmentation, which does not need to rely on the data distribution assumption of the input data. Therefore, compared with the method of using the naive Bayes model for abnormal behavior prediction, the computer device calls the pre-trained abnormal behavior prediction model to process multiple first indicator data, which can enable the abnormal behavior prediction model to better learn the correlation features between multiple first indicator data, thereby further improving the accuracy of abnormal behavior prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 This is an application environment diagram of an abnormal behavior prediction method provided by an embodiment of the present application;

[0044] Figure 2 This is a flow chart of an abnormal behavior prediction method provided in an embodiment of the present application;

[0045] Figure 3 This is a schematic diagram of a hierarchical analysis structure provided by an embodiment of the present application;

[0046] Figure 4 This is a flow chart of another abnormal behavior prediction method provided in an embodiment of the present application;

[0047] Figure 5 This is a schematic diagram of the structure of a decision tree provided in an embodiment of the present application;

[0048] Figure 6 This is a schematic diagram of the importance of various indicators provided in the embodiment of the present application;

[0049] Figure 7 This is a structural block diagram of an abnormal behavior prediction device provided in an embodiment of the present application;

[0050] Figure 8 This is a diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0052] Related technologies primarily use the Naive Bayesian algorithm to predict abnormal behavior of key individuals. However, this algorithm assumes that all features are independent of each other. However, when predicting abnormal behavior of key individuals, the collected data is all related to them, resulting in correlations between the data. Consequently, the accuracy of predicting abnormal behavior of key individuals using the Naive Bayesian algorithm is low.

[0053] In view of this, in order to improve the accuracy of abnormal behavior prediction, the present application provides an abnormal behavior prediction method, in which a computer device can first obtain multiple indicator data associated with the object to be measured, and then select multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in a pre-constructed sample indicator data table from the multiple indicator data. Finally, a pre-trained abnormal behavior prediction model is called to obtain the abnormal behavior prediction result corresponding to the object to be measured based on the multiple first indicator data; wherein, the sample indicator data table is constructed by analyzing multiple sample indicator data respectively associated with multiple sample objects, and the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by using feature segmentation. On the one hand, since the abnormal behavior prediction model is trained using data in the sample indicator data table, the computer device selects multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in the sample indicator data table from multiple indicator data associated with the object to be measured, which can ensure the consistency of the indicators of the indicator data input into the pre-trained abnormal behavior prediction model and the indicator data input into the abnormal behavior prediction model during the training process, thereby helping to improve the accuracy of the abnormal behavior prediction results for the object to be measured; on the other hand, since multiple first indicator data are associated with the object to be measured and there is a correlation between the multiple first indicator data, in addition, the abnormal behavior prediction model is constructed using feature segmentation, which does not need to rely on the data distribution assumption of the input data. Therefore, compared with the method of using a naive Bayesian model to predict abnormal behavior, the computer device calls the pre-trained abnormal behavior prediction model to process multiple first indicator data, which can enable the abnormal behavior prediction model to better learn the correlation features between multiple first indicator data, thereby further improving the accuracy of abnormal behavior prediction.

[0054] The abnormal behavior prediction method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, it includes a computer device 101 and a database server 102, wherein the computer device 101 and the database server 102 communicate through a network.

[0055] Among them, the database server 102 stores a pre-built sample indicator data table and a pre-trained abnormal behavior prediction model. The computer device 101 can obtain the above-mentioned sample indicator data table and abnormal behavior prediction model from the database server 102. The computer device 101 can also obtain multiple indicator data associated with the object to be tested, and then obtain the abnormal behavior prediction result corresponding to the object to be tested based on the multiple indicator data, the sample indicator data table and the abnormal behavior prediction model. Optionally, the computer device 101 can be a terminal device or a server, wherein the terminal device can include but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection equipment, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc.; the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services, etc., which is not limited here.

[0056] The abnormal behavior prediction method provided in the embodiments of the present application is described in detail below.

[0057] See Figure 2 , Figure 2 This is a flow chart of an abnormal behavior prediction method provided by an embodiment of the present application. This method can be applied to computer equipment (e.g. Figure 1 Computer device 101 shown). Figure 2 As shown, the abnormal behavior prediction method may include but is not limited to the following steps:

[0058] S201: Acquire multiple indicator data associated with the object to be measured.

[0059] The computer device obtains the multiple indicator data associated with the object to be measured, and may obtain the multiple indicator data associated with the object to be measured from at least one database server based on business needs.

[0060] For example, assuming the business requirement is to predict abnormal behavior of resident A in residential building 1, the computer device can obtain basic information about resident A's house, basic information about the owner, rental information, contract signing information, tenant information, etc. from the database server corresponding to the Housing and Urban-Rural Development Bureau (represented as Server 1), the database server corresponding to the Housing Management Bureau (represented as Server 2), the database server corresponding to the real estate agency (represented as Server 3), and the server corresponding to the housing management department (represented as Server 4). The computer device can also obtain resident A's age, occupation, social activity information, abnormal behavior records, etc. from the database server corresponding to the public security agency (represented as Server 5). In other words, the multiple indicator data associated with resident A include, but are not limited to, basic information about resident A's house, basic information about the owner, rental information, contract signing information, tenant information, occupation, social activity information, abnormal behavior records, etc.

[0061] It should be noted that in this application, multiple indicator data associated with the object to be tested (such as the basic information of the house where resident A lives, the basic information of the owner, the house rental information, the house contract signing information, the house tenant information, occupational information, social activity information, abnormal behavior records, age, occupational information, social activity information, abnormal behavior records, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant regulations.

[0062] S202: Select, from a plurality of indicator data, a plurality of first indicator data that are identical to the indicators corresponding to the sample indicator data in the pre-constructed sample indicator data table.

[0063] The sample indicator data table is constructed by analyzing a plurality of sample indicator data respectively associated with a plurality of sample objects.

[0064] For example, assuming that the indicators corresponding to multiple indicator data are age, gender, occupational category, and whether social relations are normal, and assuming that the indicators corresponding to each sample indicator data in the pre-constructed sample indicator data table are age, gender, and occupational category, in this case, the computer device can select the indicator data corresponding to the three indicators of age, gender, and occupational category from the multiple indicator data as multiple first indicator data.

[0065] In an optional embodiment, the sample indicator data table can be constructed by a computer device in the following manner: obtaining multiple sample indicator data respectively associated with multiple sample objects; performing data cleaning and data association processing on the multiple sample indicator data associated with each sample object, and adding a label to each sample object to obtain multiple processed sample indicator data associated with each sample object; analyzing the multiple processed sample indicator data associated with each sample object, and constructing a sample indicator data table based on the analysis results.

[0066] S203. Call a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data; wherein the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table using a feature segmentation method.

[0067] The model constructed using feature segmentation does not rely on assumptions about the data distribution of the input data. In other words, in this application, an abnormal behavior prediction model is a model that does not require assumptions about the data distribution. Exemplary abnormal behavior prediction models include decision tree models, random forest models, and extreme gradient boosting trees (eXtreme Gradient Boosting, XGBooost models, etc., which are not limited here.

[0068] In an optional embodiment, the pre-trained abnormal behavior prediction model can be stored in a computer device or in a database server that is in communication with the computer device, which is not limited here.

[0069] In the case where the pre-trained abnormal behavior prediction model is stored in the computer device, the computer device calls the pre-trained abnormal behavior prediction model by directly calling or loading the pre-trained abnormal behavior prediction model locally.

[0070] In the case where a pre-trained abnormal behavior prediction model is stored in a database server that is communicatively connected to the computer device, the computer device calls the pre-trained abnormal behavior prediction model, which can be done by calling an interface to obtain the pre-trained abnormal behavior prediction model from the database server; or by sending a request message to the database server, and the database server receives the request message accordingly, which is used to request the acquisition of the pre-trained abnormal behavior prediction model. Thereafter, the database server sends the pre-trained abnormal behavior prediction model to the computer device in response to the request message, and the computer device receives the pre-trained abnormal behavior prediction model accordingly.

[0071] In an embodiment of the present application, a computer device may first obtain multiple indicator data associated with the object to be measured, and then select multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in a pre-constructed sample indicator data table from the multiple indicator data. Finally, a pre-trained abnormal behavior prediction model is called to obtain an abnormal behavior prediction result corresponding to the object to be measured based on the multiple first indicator data; wherein, the sample indicator data table is constructed by analyzing multiple sample indicator data respectively associated with multiple sample objects, and the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data respectively corresponding to multiple sample objects included in the sample indicator data table. According to this method, on the one hand, since the abnormal behavior prediction model is trained using data in the sample indicator data table, the computer device selects multiple first indicator data that are the same as the indicators corresponding to each sample indicator data in the sample indicator data table from multiple indicator data associated with the object to be measured, which can ensure the consistency of the indicators input into the pre-trained abnormal behavior prediction model and the indicator data input into the abnormal behavior prediction model during the training process, thereby helping to improve the accuracy of the abnormal behavior prediction results for the object to be measured; on the other hand, since multiple first indicator data are associated with the object to be measured and there is a correlation between the multiple first indicator data, in addition, the abnormal behavior prediction model is constructed by feature segmentation, which does not need to rely on the data distribution assumption of the input data. Therefore, compared with the method of using the naive Bayes model for abnormal behavior prediction, the computer device calls the pre-trained abnormal behavior prediction model to process multiple first indicator data, which can enable the abnormal behavior prediction model to better learn the correlation features between multiple first indicator data, thereby further improving the accuracy of abnormal behavior prediction.

[0072] In an optional embodiment, Figure 2 In the abnormal behavior prediction method shown, the sample indicator data table can be constructed by a computer device through the following steps:

[0073] Step 1: Acquire multiple sample indicator data associated with multiple sample objects.

[0074] In some embodiments, the computer device obtains multiple sample indicator data respectively associated with multiple sample objects, and may obtain multiple sample indicator data respectively corresponding to multiple sample objects of different dimensions from different database servers based on business needs.

[0075] For example, assuming that the business requirement is to predict the abnormal behavior of residents in residential building 1, the computer device obtains multiple sample data indicators corresponding to multiple sample objects of different dimensions from different database servers. It can be obtained from the database server corresponding to the Housing and Urban-Rural Development Bureau (denoted as server 1), the database server corresponding to the Housing Management Bureau (denoted as server 2), the database server corresponding to the real estate agency (denoted as server 3), and the database server corresponding to the housing management department (denoted as server 4) to obtain the basic information of the house where each resident lives, the basic information of the owner, the house rental information, the house contract signing information, the house tenant information, etc.; obtain the age, occupation information, social activity information, abnormal behavior records, etc. of each resident from the database server corresponding to the public security agency (denoted as server 5); obtain the number of times each resident enters and exits the entertainment venue (such as a bath center) from the database server corresponding to the entertainment venue (denoted as server 6), etc.

[0076] It should be noted that in this application, multiple sample indicator data associated with multiple sample objects (such as the basic information of the houses where the above-mentioned residents live, the basic information of the owners, the house rental information, the house contract signing information, the house tenant information, occupational information, social activity information, abnormal behavior records, age, occupational information, social activity information, abnormal behavior records, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant regulations.

[0077] Step 2: For the multiple sample indicator data associated with each sample object, select multiple candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the multiple sample indicator data.

[0078] In some embodiments, the computer device selects multiple candidate sample indicators for abnormal behavior prediction from the indicators corresponding to the multiple sample indicator data associated with each sample object. The computer device may perform data cleaning and data association processing on the multiple sample indicator data associated with each sample object, and add labels to each sample object to obtain multiple processed sample indicator data associated with each sample object; for the multiple processed sample indicator data associated with each sample object, multiple candidate sample indicators for abnormal behavior prediction are selected from the indicators corresponding to the multiple processed sample indicator data.

[0079] Optionally, the computer device performs data cleaning on the multiple sample indicator data associated with each sample object, which may include but is not limited to filtering, deduplication, format conversion, and verification of the multiple sample indicator data associated with each sample object.

[0080] Optionally, the multiple sample indicator data respectively associated with the multiple sample objects are obtained by the computer device from multiple different database servers; the computer device performs data association processing on the multiple sample indicator data respectively associated with the multiple sample objects, which may include association processing on the multiple sample indicator data from different database servers.

[0081] For example, the computer device may associate entertainment venue customer information and exception records with the tenants of each house in residential building 1, extract the number of times each tenant enters and exits the entertainment venue, and the exception records. The resulting quality-compliant data is then associated with other business data to extract the relationships between key elements. For example, the key element "tenant" (real identity information element object) is extracted from the tenant information, and the key element "house information" (property information element object) is extracted from the basic house information. The relationship between these two elements is "lease relationship - renting." Another example is the key element "tenant" is extracted from the tenant information, and the key elements "case type + case number" are extracted from the exception records. The relationship between these three elements is "involved relationship - involved event - involved case."

[0082] Optionally, the computer device performs data labeling processing on multiple sample indicator data associated with each sample object, and may add a label to each sample object based on the degree of correlation between the personal information of each sample object and the abnormal behavior.

[0083] For example, the computer device may analyze resident A's occupational category and assign a label to resident A based on the correlation between the occupational category and the unusual behavior. For example, if the correlation between resident A's occupational category and the unusual behavior is high, resident A may be labeled "Key Industry Service Personnel"; if the correlation between resident A's occupational category and the unusual behavior is moderate, resident A may be labeled "Possibly Involved Industry Practitioner"; if the correlation between resident A's occupational category and the unusual behavior is low, resident A may be labeled "Other Industry Practitioners." The computer device may also analyze resident A's social relationships to determine whether resident A has a social relationship with someone with an unusual record, and assign a label to resident A based on the determination. For example, if resident A has a social relationship with someone with an unusual record, resident A may be labeled "Abnormal Social Relationship"; if resident A does not have a social relationship with someone with an unusual record, resident A may be labeled "Normal Social Relationship."

[0084] Step 3: Perform membership division on multiple candidate sample indicators to obtain the membership value corresponding to each candidate sample indicator, and determine multiple target sample indicators from the multiple candidate sample indicators based on the membership value corresponding to each candidate sample indicator.

[0085] The membership value describes the degree to which an element belongs to a fuzzy set. The membership value range is [0, 1]. Values ​​closer to 1 indicate that the element belongs more closely to the fuzzy set, while values ​​closer to 0 indicate that the element has a weaker relationship with the fuzzy set.

[0086] Exemplarily, multiple candidate sample indicators include age, gender, occupational category, whether social relationships are normal, whether social media is normal, whether communication information is normal, whether there are abnormal consumer transactions, whether there is a criminal record, whether one frequently visits entertainment venues, whether one frequently visits bathing centers, the number of times non-tenants enter and exit the apartment building, and the time periods when non-tenants enter and exit the apartment building.

[0087] The following uses multiple candidate sample indicators as the indicators in the above example as an example, divides the multiple candidate sample indicators into membership levels, and obtains the membership value of each candidate sample indicator object for illustration.

[0088] (1) For the indicator of age, the computer equipment can divide the age range from 0 to 22 years old into 0.1, 22 to 35 years old into 0.5, 35 to 45 years old into 0.3, and 45 years old and above into 0.1.

[0089] (2) For the gender indicator, the computer equipment can classify females as having a membership degree of 0.7 and males as having a membership degree of 0.3.

[0090] (3) For the indicator of occupational category, computer equipment can classify service personnel in key industries (such as entertainment venue staff, massage and sauna service personnel, hotel and inn practitioners, and beauty and hairdressing industry personnel) as having a membership degree of 0.6; classify practitioners in industries that may be involved (such as online anchors and social media practitioners, self-employed individuals and freelancers, and migrant workers engaged in low-skilled labor) as having a membership degree of 0.4; and classify practitioners in other industries as having a membership degree of 0.1.

[0091] (4) As for the indicator of whether the social relationship is normal, the computer equipment can analyze whether there is a social relationship between the person and the person with abnormal records. If so, it is determined that the social relationship of the person is abnormal and the membership value is assigned to 1; if not, it is determined that the social relationship of the person is normal and the membership value is assigned to 0.

[0092] (5) Regarding the indicator of whether social media is normal, the computer equipment can analyze whether the content posted by the person on social media contains abnormal information or abnormal hints, and count the frequency and content of the person's interaction with abnormal accounts on social media to determine whether there is an abnormal state; if the content posted by the person on social media contains abnormal information or abnormal hints, or the person is in an abnormal state on social media, then the person's social media is judged to be abnormal and a membership value of 1 is assigned; if the content posted by the person on social media does not contain abnormal information or abnormal hints, or the person is in an abnormal state on social media, then the person's social media is judged to be normal and a membership value of 0 is assigned.

[0093] (6) Regarding the indicator of whether the communication information is normal, the computer equipment can retrieve the call records and text messages or instant messaging chat records of the person to see whether there is frequent contact with abnormal calls or text messages, and whether there are abnormal messages or abnormal hints. If so, it is determined that the person's communication information is abnormal and the membership value is assigned to 1; if not, it is determined that the person's communication information is normal and the membership value is assigned to 0.

[0094] (7) Regarding the indicator of whether there are abnormal consumer transactions, computer equipment can check the individual's bank account transaction records, especially large transfers and frequent small transactions, which may indicate the source and scale of the funds for their abnormal activities. Analyze the individual's consumption records to see whether there are consumption behaviors related to key places (such as bath centers, entertainment venues, etc.). If so, it is determined that the individual has abnormal consumer transactions and the membership value is assigned to 1; if not, it is determined that the individual has no abnormal consumer transactions and the membership value is assigned to 0.

[0095] (8) Regarding the indicator of whether there is a criminal record, the computer equipment can check whether the person has any abnormal record, whether he has been reported to the police or become the target of the report due to abnormal problems, and whether he has received administrative penalties such as fines or detention due to abnormal problems based on public security data. If there is a criminal record, the membership value is assigned to 1; if there is no criminal record, the membership value is assigned to 0.

[0096] (9) For the indicator of whether one frequently visits entertainment venues, the number of times one visits entertainment venues is calculated on a monthly basis. If the number of times exceeds 8, the membership degree is 0.8; if the number of times is between 6 and 8, the membership degree is 0.6; if the number of times is between 3 and 5, the membership degree is 0.3; and if the number of times is between 0 and 2, the membership degree is 0.1.

[0097] (10) Regarding whether one frequently visits a bathing center, the number of times one visits a bathing center is calculated on a monthly basis. If the number of times exceeds 8, the membership degree is 0.8; if the number of times is between 6 and 8, the membership degree is 0.6; if the number of times is between 3 and 5, the membership degree is 0.3; and if the number of times is between 0 and 2, the membership degree is 0.1.

[0098] (11) The number of times non-tenants enter and exit the apartment building is calculated on a monthly basis. If the number of times is more than 15 times, the membership level is 0.8; if it is 10 to 15 times, the membership level is 0.6; if it is 5 to 9 times, the membership level is 0.4; and if it is 0 to 4 times, the membership level is 0.1.

[0099] (12) For the time periods when non-tenants enter and exit the apartment building most of the time, the period from 23:00 to 4:00 is assigned a membership degree of 0.8; the period from 4:00 to 20:00 is assigned a membership degree of 0.1; and the period from 20:00 to 23:00 is assigned a membership degree of 0.3.

[0100] The AHP (Analytical Hierarchy Process) is a decision-making method that decomposes elements relevant to decision-making into hierarchies such as goals, criteria, and options, and then conducts qualitative and quantitative analysis based on these hierarchies. It can be used to determine the degree of influence of associated parameters on the target outcome by comparing them pairwise. Based on the nature of the problem and the overall goal to be achieved, the AHP breaks down the problem into its various components. It then clusters and combines these factors at different levels based on their interrelationships and affiliations, forming a multi-level analytical structure model. Ultimately, the problem is reduced to determining the relative importance of the lowest level (options and measures for decision-making) relative to the highest level (overall goal), or ranking them in relative order of merit.

[0101] In some embodiments, the hierarchical analysis structure is generally divided into three layers, the top layer is the target layer, the bottom layer is the solution layer, and the middle layer is the criterion layer or indicator layer. In this application, the hierarchical analysis structure constructed by the computer device based on multiple candidate sample indicators can be as follows: Figure 3 As shown, the first layer is the target layer, which is used to determine whether a person is abnormal, and the second layer is the indicator layer, which includes multiple candidate sample indicators.

[0102] Step 4: Standardize the multiple target sample indicator data corresponding to the multiple target sample indicators to obtain multiple standard sample indicator data.

[0103] In some embodiments, a computer device performs standardization processing on multiple target sample indicator data corresponding to multiple target sample indicators to obtain multiple standard sample indicator data, which may include: converting the target indicator data whose variable type is a categorical variable in the multiple target indicator data to obtain target indicator data of quantitative variables, and using the target indicator data of the quantitative variables as standard sample indicator data.

[0104] Step 5: Construct a sample indicator data table based on multiple standard sample indicator data corresponding to each sample object.

[0105] Using this implementation, the computer device can first obtain multiple sample indicator data respectively associated with multiple sample objects, and then, for the multiple sample indicator data associated with each sample object, select multiple candidate sample indicators for abnormal behavior prediction from the indicators corresponding to the multiple sample indicator data, and then determine the membership value corresponding to each candidate sample, and based on the membership value corresponding to each candidate sample, determine multiple target sample indicators from the multiple candidate sample indicators, and then standardize the multiple target sample indicators. Finally, construct a sample indicator data table for the multiple standardized target sample indicator data corresponding to each sample object. In this way, since abnormal behavior prediction is a judgment and decision-making problem with a strong subjectivity, and membership is suitable for decision-making problems with a strong subjectivity, especially scenarios that require expert experience or qualitative judgment, where the membership function can directly deal with fuzziness and uncertainty problems and quantify imprecise information through fuzzy mathematics. Therefore, the computer device determines multiple target sample indicators that are more in line with subsequent abnormal behavior predictions from multiple candidate sample indicators based on the membership value corresponding to each candidate sample, thereby facilitating the construction of a sample indicator data table, and further, facilitating the subsequent acquisition of an abnormal behavior prediction model that is more suitable for abnormal behavior prediction.

[0106] In an optional embodiment, in the above step three, the computer device determines multiple target sample indicators from multiple candidate sample indicators based on the membership value corresponding to each candidate sample indicator, which may include: using the hierarchical analysis method to determine the initial weight corresponding to each candidate sample indicator; for each candidate sample indicator, based on the initial weight and membership value corresponding to the candidate sample indicator, determining the standard weighted weight corresponding to the candidate sample indicator; from the multiple candidate sample indicators, selecting multiple candidate sample indicators whose standard weighted weights are greater than a preset standard weighted weight threshold as multiple target sample indicators.

[0107] In some embodiments, the computer device uses the analytic hierarchy process to determine the initial weight corresponding to each candidate sample indicator, which may include but is not limited to the following steps:

[0108] Step 1: Construct a judgment matrix.

[0109] Optionally, the judgment matrix A constructed by the computer device may be as shown in the following formula (1).

[0110] (1)

[0111] In formula (1), the elements in A satisfy the following conditions: 、 、 Among them, the judgment matrix is ​​a comparison of the relative importance of all factors in this layer to a certain factor in the previous layer. ijIt represents the comparison result of the i-th factor relative to the j-th factor. ij The value of may be determined by a computer device based on a scaling method of 1-9 as shown in Table 1 below.

[0112] Table 1 Element a in the judgment matrix ij Scaling method table

[0113]

[0114] Step 2: Find the eigenvector of the judgment matrix.

[0115] The eigenvector of the judgment matrix includes the initial weight corresponding to each candidate indicator.

[0116] Optionally, the computer device may calculate the eigenvector of the judgment matrix using an arithmetic mean method. The process of calculating the eigenvector of the judgment matrix using an arithmetic mean method may include the following steps:

[0117] (1) Perform column normalization on the judgment matrix.

[0118] Optionally, the computer device performs column normalization processing on the judgment matrix, which may be performed by dividing each element in the judgment matrix by the sum of the column in which the element is located.

[0119] For example, assuming For an n-order square matrix, the computer device normalizes each column vector in A, and the normalized judgment matrix can be expressed as ,in, , i=1,2,...,n; j=1,2,...,n.

[0120] (2) Add up the elements of the judgment matrix after column normalization by row.

[0121] Following the example in step (1) above, the computer device can Add the elements in row by row to get the summed matrix ,in, , i=1,2,...,n; j=1,2,...,n.

[0122] (3) The summed result is normalized to obtain the eigenvector of the judgment matrix.

[0123] Continuing with the example in step (2) above, the computer device can normalize C to obtain the eigenvector of the judgment matrix ,in, , i=1,2,...,n.

[0124] Step 3: Perform consistency check on the judgment matrix.

[0125] The consistency test is the process of testing the judgment matrix A using the consistency index, the consistency ratio <0.1 and the numerical table of the random consistency index.

[0126] Optionally, the computer device performing consistency check on the judgment matrix A may include the following steps:

[0127] (1) Determine the maximum eigenvalue of the judgment matrix.

[0128] The maximum eigenvalue of the judgment matrix determined by the computer device can be expressed as the following formula (2).

[0129] (2)

[0130] In formula (2), It represents the maximum characteristic root of the judgment matrix; (AW i ) represents the i-th component of AW.

[0131] (2) Determine the consistency index CI.

[0132] Optionally, the consistency index CI can be expressed as the following formula (3).

[0133] (3)

[0134] In formula (3), represents the maximum eigenvalue of the judgment matrix; n represents the unique non-zero eigenvalue (the number of rows in the matrix). If CI is 0, it indicates complete consistency; if CI is close to 0, it indicates satisfactory consistency; the larger the CI, the less consistent it is.

[0135] (3) Determine random consistency RI.

[0136] Optionally, the result of random consistency RI may be shown in Table 2 below.

[0137] Table 2 Results of random consistency RI

[0138]

[0139] It can be seen from Table 2 that the larger the value of n, the larger the value of random consistency RI.

[0140] (4) Determine the consistency ratio CR based on the consistency CI and random consistency RI.

[0141] Alternatively, the consistency ratio CR can be expressed as the following formula (4).

[0142] (4)

[0143] Among them, when the consistency ratio CR is less than 0.1, it can be considered that the inconsistency of the judgment matrix A is within the allowable range. In this case, if there is satisfactory consistency, the consistency test can be passed, that is, it is determined that the consistency of the judgment matrix is ​​acceptable. Otherwise, the judgment matrix needs to be corrected.

[0144] Step 4: When it is determined that the judgment matrix A passes the consistency test, the eigenvector of the judgment matrix obtained in step 2 is , determine the initial weight of each candidate indicator.

[0145] Among them, w1 represents the initial weight of candidate indicator 1; w2 represents the initial weight of candidate indicator 2; and so on, w n It represents the initial weight of the candidate index n.

[0146] In some embodiments, the computer device determines, for each candidate sample indicator, the standard weighted weight corresponding to the candidate sample indicator based on the initial weight and membership value corresponding to the candidate sample indicator, which may include: determining the standard weighted matrix corresponding to the candidate sample indicator based on the initial weight and membership value corresponding to the candidate sample indicator; determining the standard weighted weight corresponding to the candidate sample indicator based on the standard weighted matrix corresponding to the candidate sample indicator.

[0147] Optionally, the membership value corresponding to the candidate sample index can be expressed as the following formula (5).

[0148] X∈(x1,...,x i ,...,x n ) (5)

[0149] In formula (5), X represents the candidate sample index, x i It represents the i-th membership value of the candidate sample indicator.

[0150] For example, assuming that the candidate sample indicator is age, the membership value corresponding to age is 0.1 for 0-22 years old, 0.5 for 22-35 years old, 0.3 for 35-45 years old, and 0.1 for those over 45 years old. Then the membership value corresponding to age can be expressed as X(age)∈(0.1, 0.5, 0.3, 0.1).

[0151] Optionally, the standard weighted matrix Z corresponding to the candidate sample index can be expressed as the following formula (6).

[0152] (6)

[0153] In formula (6), x iIt represents the i-th membership value of candidate sample index 1; w1 represents the initial weight of candidate sample index 1.

[0154] Optionally, the computer device determines the standard weighted weight corresponding to the candidate sample indicator based on the standard weighted matrix corresponding to the candidate sample indicator, and can add each element in the standard weighted matrix corresponding to the candidate sample indicator to obtain the standard weighted weight corresponding to the candidate sample indicator.

[0155] For example, assuming that candidate sample indicator 1 is age, X(age)∈(0.1, 0.5, 0.3, 0.1), and assuming that the initial weight corresponding to age is 0.1175, then the standard weighted weight corresponding to age is 0.1*0.1175+0.5*0.1175+0.3*0.1175+0.1*0.1175=0.1175.

[0156] By adopting this embodiment, since the hierarchical analysis method can ensure the logical rationality of expert judgment and reduce subjective bias through consistency testing, the computer device can use the hierarchical analysis method to more accurately determine the initial weight corresponding to each candidate sample indicator, and then, based on the initial weight and membership value corresponding to each candidate sample indicator, more accurately determine the standard weighted weight of each candidate sample indicator, so that the computer device can select multiple target sample indicators that are more consistent with subsequent abnormal behavior prediction from multiple candidate sample indicators based on the standard weighted weights corresponding to each candidate sample indicator.

[0157] In an optional embodiment, in the above step 2, the computer device selects multiple candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the multiple sample indicator data associated with each sample object, which may include: for the multiple sample indicator data associated with each sample object, based on the association parameters corresponding to the abnormal behavior to be predicted, selecting multiple candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the multiple sample indicator data.

[0158] By adopting this embodiment, the computer device can select multiple candidate sample indicators for abnormal behavior prediction from multiple sample indicator data associated with each sample object based on the associated parameters corresponding to the abnormal behavior to be predicted. This can reduce the amount of data that needs to be processed subsequently, thereby helping to improve the efficiency of subsequent training of the abnormal behavior prediction model.

[0159] In an optional embodiment, the number of sample objects in the above-mentioned sample indicator data table is N, where N is a positive integer; the abnormal behavior prediction model can be obtained by a computer device in the following manner: based on multiple target sample indicator data corresponding to X sample objects, determining the weighted Gini coefficient of the indicator corresponding to each target sample indicator data; X is a positive integer less than N; constructing a decision tree model based on the weighted Gini coefficient of each indicator; training the decision tree model based on each target sample indicator data to obtain a trained decision tree model; testing the trained decision tree model based on multiple target sample indicator data corresponding to Y sample objects, and if the test result indicates that the test passed, using the tested decision tree model as the abnormal behavior prediction model; wherein Y+X=N.

[0160] In some embodiments, the decision tree model can be a classification and regression tree (CART) model. The CART model is a type of decision tree model, and the generation of the CART model is the process of recursively constructing a binary tree. Feature selection is performed on the regression tree using the squared error minimization criterion, and on the classification tree using the Gini coefficient minimization criterion to generate a binary tree. This model can solve both classification problems (decision tree classification) and regression problems (decision tree regression). In the process of using a decision tree to solve a classification problem, the mode of the output variable among the samples contained in the leaf nodes of the classification decision tree is the classification result. Common evaluation criteria for classification decision trees include information entropy and the Gini coefficient. In the process of using a decision tree to solve a regression problem, the average value of the output variable among the samples contained in the leaf nodes of the regression tree is the prediction result. Regression decision trees often use metrics such as mean squared error (MSE) and mean absolute error (MAE) to measure the prediction performance of the model.

[0161] The Gini coefficient is a measure of the purity of a dataset, ranging between 0 and 1. A Gini coefficient closer to 0 indicates a higher purity of the dataset, meaning all samples belong to the same category. A Gini coefficient closer to 1 indicates a lower purity of the dataset, meaning the sample categories are more dispersed. During decision tree classification, calculating the Gini coefficient helps select the optimal classification conditions to minimize the Gini coefficient after classification, thereby maximizing the purity of the classification.

[0162] In some embodiments, when a computer device determines a weighted Gini coefficient of an indicator corresponding to each target sample indicator data based on multiple target sample indicator data corresponding to X sample objects, the following formula (7) may be used.

[0163] (7)

[0164] In formula (7), It represents the weighted Gini coefficient corresponding to the indicator P; K represents the number of categories divided by the indicator p, P k It represents the probability of the kth category corresponding to the indicator p.

[0165] In some embodiments, in order to reduce the overfitting problem in the training decision tree model, the computer device can prune the decision tree. Optionally, the pruning of the decision tree can be a pre-pruning process of the decision tree, or a post-pruning process of the decision tree, which is not limited at this time. Pre-pruning refers to the process of estimating each node before dividing it during the decision tree generation process. If the division of the current node cannot bring about an improvement in the generalization performance of the decision tree, the division is stopped and the current node is marked as a leaf node; post-pruning refers to first generating a complete decision tree from the training set, and then examining the non-leaf nodes from the bottom up. If replacing the subtree corresponding to the node with a leaf node can bring about an improvement in the generalization performance of the decision tree, the subtree is replaced with a leaf node.

[0166] By adopting this embodiment, the computer device trains and verifies the abnormal behavior prediction model based on multiple target sample indicator data corresponding to each sample object in the sample indicator data table. In this way, an abnormal behavior prediction model with better performance can be obtained, which is conducive to improving the prediction accuracy when the trained abnormal behavior prediction model is used to predict abnormal behavior of the object to be tested.

[0167] In an optional embodiment, Figure 2 In the abnormal behavior prediction method shown, a computer device calls a pre-trained abnormal behavior prediction model and obtains an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data. It may include: standardizing the multiple first indicator data respectively to obtain multiple second indicator data; inputting the multiple second indicator data into the pre-trained abnormal behavior prediction model to obtain the abnormal behavior prediction result corresponding to the object to be tested.

[0168] With this implementation, since the abnormal behavior prediction model is trained using data in the sample indicator data table, and the data in the sample indicator data table is data obtained after standardization processing, the computer device obtains multiple second indicator data by standardizing multiple first indicator data respectively, and inputs the multiple second indicator data into the pre-trained abnormal behavior prediction model. In this way, the consistency of the format or structure of the data input into the abnormal behavior prediction model during actual application and the data input into the abnormal behavior prediction model during training can be ensured, thereby helping to improve the accuracy of the abnormal behavior prediction results corresponding to the object to be tested.

[0169] The following describes the overall process of the abnormal behavior prediction method provided by the embodiment of this application. Figure 4 , Figure 4 This is a flow chart of another abnormal behavior prediction method provided by the embodiment of the present application. Figure 4 As shown, the abnormal behavior prediction method may include but is not limited to the following steps:

[0170] S401. Collect data aggregated to the big data platform, perform data governance and data cleaning on the data, and obtain processed data.

[0171] S402. Based on the processed data, an indicator system is constructed to determine whether the apartment residents have engaged in abnormal behavior.

[0172] In an optional embodiment, the computer device constructs an indicator system for judging whether the apartment occupants have engaged in abnormal behavior based on the processed data. The indicator system for judging whether the apartment occupants have engaged in abnormal behavior can be selected from the indicators corresponding to the processed data based on the associated parameters corresponding to the abnormal behavior to be predicted.

[0173] For example, the indicator system for determining whether apartment residents engage in abnormal behavior may be shown in Table 3 below.

[0174] Table 3

[0175]

[0176] S403. Determine a data set based on an indicator system for determining whether apartment residents engage in abnormal behavior.

[0177] Among them, this dataset is used to train and test the abnormal behavior prediction model.

[0178] S404: Perform membership division on each indicator in the indicator system to obtain a membership value corresponding to each indicator.

[0179] In an optional implementation, the relevant description of step S404 can refer to the aforementioned description of step three in constructing the sample indicator data table for computer devices, and will not be repeated here.

[0180] S405: Determine the standard weight corresponding to each indicator based on the membership value corresponding to each indicator and the hierarchical analysis method.

[0181] In an optional embodiment, the relevant explanation of step S405 can be found in the aforementioned description of the computer device determining multiple target sample indicators from multiple candidate sample indicators based on the membership value corresponding to each candidate sample indicator and the hierarchical analysis method, which will not be repeated here.

[0182] S406: Based on the standard weighted weights of each indicator, multiple target indicators for constructing a decision tree are selected from the multiple indicators.

[0183] S407: Obtain indicator data corresponding to a plurality of target indicators from the data set, perform labeling on the obtained indicator data to obtain processed indicator data, and construct a sample indicator data table based on the processed indicator data.

[0184] Optionally, the computer device performs labeling processing on the acquired indicator data to obtain processed indicator data, which may include converting categorical variables into quantitative variables to obtain processed indicator data, such as assigning an integer from 1 to n to a text variable.

[0185] For example, the processed indicator data may be shown in Table 4 below.

[0186] Table 4

[0187]

[0188] S408. Divide the data in the sample indicator data table into a training set and a test set.

[0189] Optionally, the computer device divides the data in the sample indicator data table into a training set and a test set, and may divide the data in the sample indicator data table into a training set and a test set according to a division ratio of 7:3.

[0190] S409: Build and train a decision tree model using the data in the training set to obtain a trained decision tree model.

[0191] For example, the data in the training set may be shown in Table 5 below.

[0192] Table 5

[0193]

[0194] Optionally, taking the data in the training set as Table 5 above as an example, the computer device uses the data in the training set to construct a decision tree model. The method may be to first use the above formula (7) to determine the weighted Gini coefficient corresponding to each indicator in the training set data shown in Table 5; then, select the indicator with the smallest weighted Gini coefficient as the root node, divide the left and right subtrees with the root node as the center, and construct a decision tree with the goal of determining that the Gini coefficient of the leaf node is 0.

[0195] As can be seen from Table 5, for the indicator of age, the number of people aged 35 and below is 10, and the number of people aged 35 and above is 0. The computer equipment can use the above formula (7) to determine the weighted Gini coefficient of the indicator of age:

[0196] ;

[0197] ;

[0198] .

[0199] In other words, the weighted Gini coefficient corresponding to the age indicator is 2 / 5.

[0200] For the gender indicator, the number of male personnel is 3, and the number of female personnel is 7. The number of personnel over 35 years old is 0. The weighted Gini coefficient for the gender indicator can be determined using the above formula (7):

[0201] ;

[0202] ;

[0203] .

[0204] In other words, the weighted Gini coefficient corresponding to the gender indicator is 44 / 105.

[0205] For the indicator of occupational category (whether or not a key industry service worker), 5 is for yes and 5 is for no. The weighted Gini coefficient of computer equipment can be determined by the aforementioned formula (7):

[0206] ;

[0207] ;

[0208] .

[0209] In other words, the weighted Gini coefficient corresponding to the indicator of occupational category (whether or not a service worker in a key industry) is 2 / 5.

[0210] Regarding the indicator of whether social relations are normal, normal accounts for 8 and abnormal accounts for 2. Computer equipment can use the above formula (7) to determine the weighted Gini coefficient of this indicator:

[0211] ;

[0212] ;

[0213] .

[0214] In other words, the weighted Gini coefficient corresponding to the indicator of whether social relations are normal is 19 / 40.

[0215] Regarding the indicator of whether social media is normal, 7% are normal and 3% are abnormal. Computer equipment can use the above formula (7) to determine the weighted Gini coefficient of this indicator:

[0216] ;

[0217] ;

[0218] .

[0219] In other words, the weighted Gini coefficient corresponding to the indicator of whether social media is normal is 10 / 21.

[0220] Regarding the indicator of whether the communication information is normal, normal accounts for 8 and abnormal accounts for 2. The weighted Gini coefficient of the indicator can be determined by the aforementioned formula (7) for computer equipment:

[0221] ;

[0222] ;

[0223] .

[0224] In other words, the weighted Gini coefficient corresponding to the indicator of whether communication information is normal is 2 / 5.

[0225] Regarding the indicator of whether there is an abnormal consumption record, yes accounts for 3 and no accounts for 7. The computer equipment can use the above formula (7) to determine the weighted Gini coefficient of this indicator:

[0226] ;

[0227] ;

[0228] .

[0229] In other words, the weighted Gini coefficient corresponding to the indicator of whether there are abnormal consumption records is 12 / 35.

[0230] Regarding the indicator of whether there is a criminal record, yes accounts for 2 and no accounts for 8. The computer equipment can use the above formula (7) to determine the weighted Gini coefficient of this indicator:

[0231] ;

[0232] ;

[0233] .

[0234] In other words, the weighted Gini coefficient corresponding to the indicator of whether or not there is a criminal record is 2 / 5.

[0235] Regarding the indicator of whether one frequently visits entertainment venues, yes accounts for 6 and no accounts for 4. The weighted Gini coefficient of this indicator can be determined by using the aforementioned formula (7):

[0236] ;

[0237] ;

[0238] .

[0239] In other words, the weighted Gini coefficient corresponding to the indicator of whether one frequently visits entertainment venues is 7 / 15.

[0240] Regarding the indicator of whether one frequently visits a bathing center, 5 is assigned to "yes" and 5 is assigned to "no." The computer equipment can use the aforementioned formula (7) to determine the weighted Gini coefficient of this indicator:

[0241] ;

[0242] ;

[0243] .

[0244] In other words, the weighted Gini coefficient corresponding to the indicator of whether or not one frequently visits a bathing center is 12 / 25.

[0245] Regarding the indicator of whether non-tenants frequently enter and exit the apartment building, 7 are for yes and 3 are for no. The weighted Gini coefficient of this indicator can be determined by the aforementioned formula (7) for computer equipment:

[0246] ;

[0247] ;

[0248] .

[0249] In other words, the weighted Gini coefficient corresponding to the indicator of whether non-tenants frequently enter and exit the apartment building is 6 / 35.

[0250] Regarding the indicator of whether the entry and exit of non-tenant personnel in the apartment building is during the key time period, the key time period accounts for 8, and the non-key time period accounts for 2. The computer equipment can use the above formula (7) to determine the weighted Gini coefficient of this indicator:

[0251] ;

[0252] ;

[0253] .

[0254] In other words, the weighted Gini coefficient corresponding to the indicator of whether non-tenant people entering and leaving the apartment building are in key time periods is 3 / 10.

[0255] Since a smaller weighted Gini coefficient indicates higher data purity, the computer can use the indicator corresponding to the smallest weighted Gini coefficient (i.e., 6 / 35) among the weighted Gini coefficients corresponding to the aforementioned indicators (i.e., whether non-tenants frequently enter and exit the apartment building) as the root node of the decision tree. The computer can then split the decision tree into left and right subtrees, centered around the root node. For example, the left subtree is "yes" and the right subtree is "no." As shown in Table 5, in the left subtree, there are 6 people with a label value (i.e., whether anomaly is present) of "yes" and 1 person with a label value of "no." In the right subtree, there are 0 people with a label value of "yes" and 3 people with a label value of "no." In this case, the three data points in the right subtree can be directly labeled "no." That is, if a non-tenant's entry and exit of the apartment building is outside of a key time period, the person can be considered "not anomaly." At this point, the Gini coefficient of this leaf node is 0, and no further subtree is needed. For the 7 data in the left subtree, the same operation as above can be performed to calculate the weighted Gini coefficient of each indicator, find the indicator corresponding to the smallest weighted Gini coefficient as the next node, and divide the next node, and so on, until the Gini coefficient of the final leaf node is 0, and the constructed decision tree is obtained. Among them, the structure of the constructed decision tree can be as follows Figure 5 As shown. Figure 5 As shown in the figure, the internal nodes of a decision tree specify the specific splitting of the branched features (indicators), i.e., the split is based on a specific split value of a feature. Here, gini determines which feature is split; the value sample type distribution is the number of samples belonging to each classification group at the node. For example, [10, 5, 5] indicates that there are 10, 5, and 5 samples in the three classification groups, respectively. The class classification is the classification group to which the samples at the node are uniformly assigned (this is determined by the group with the largest number of samples).

[0256] Optionally, in the process of constructing the decision tree, the computer device may also determine the importance of each indicator (denoted as feature_importance) based on the impurity corresponding to each indicator (calculated using the Gini coefficient or information entropy) using the following formula (8).

[0257] (8)

[0258] In formula (8), N represents the total number of samples; Nt represents the number of samples of the current node; impurity represents the impurity, that is, the Gini coefficient; Nt_L represents the number of samples of the left child node of the current node; Nt_R represents the number of samples of the right child node of the current node; right_impurity represents the impurity of the right child node; left_impurity represents the impurity of the left child node.

[0259] For example, the importance of each indicator can be as follows: Figure 6 As shown. Figure 6 It can be seen that the time period when people enter and exit the apartment building most often is the most important; occupational category is the least important.

[0260] Optionally, after determining the importance of each indicator, the computer device may determine whether the sum of the importance of each indicator is 1; if it is not 1, the importance of each indicator is normalized.

[0261] S410: Testing the trained decision tree model based on the data in the test set, and using the tested decision tree model as an abnormal behavior prediction model if the test result indicates that the test has passed.

[0262] Among them, the model parameters of the abnormal behavior prediction model can be shown in Table 6 below.

[0263] Table 6

[0264]

[0265] Among them, the evaluation results corresponding to the decision tree model are shown in Table 7 below.

[0266] Table 7

[0267]

[0268] In Table 7, accuracy refers to the proportion of correctly predicted samples to the total samples; recall refers to the proportion of predicted positive samples among the results that are actually positive samples; precision refers to the proportion of predicted positive samples among the results that are actually positive samples; F1 refers to the harmonic mean of precision and recall.

[0269] S411 . Acquire multiple indicator data associated with the object to be measured, and select, from the multiple indicator data, multiple first indicator data that are identical to the indicators corresponding to each sample indicator data in a pre-constructed sample indicator data table.

[0270] S412: Calling an abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on a plurality of first indicator data.

[0271] The implementation of the present application not only improves the accuracy of abnormal behavior predictions but also allows relevant personnel to promptly identify potential abnormal individuals based on the prediction results, thereby enabling them to take relevant measures to prevent possible abnormal behavior, reduce public security issues, and ultimately safeguard public order. Furthermore, it allows relevant personnel to allocate more resources to areas with high abnormal risk based on the prediction results. This, by optimizing the allocation of relevant resources, can improve their utilization rate.

[0272] Optionally, the abnormal behavior prediction method provided in the embodiment of the present application can be integrated into an intelligent monitoring system to improve the automation and intelligence level of the monitoring system, thereby reducing dependence on manual monitoring.

[0273] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0274] Based on the same inventive concept, the present application also provides an abnormal behavior prediction device for implementing the abnormal behavior prediction method described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more abnormal behavior prediction device embodiments provided below can be found in the above-mentioned limitations of the abnormal behavior prediction method and will not be repeated here.

[0275] In an exemplary embodiment, Figure 7 As shown, an abnormal behavior prediction device is provided, which includes but is not limited to the following modules:

[0276] The acquisition module 701 is used to acquire multiple indicator data associated with the object to be measured;

[0277] A selection module 702 is configured to select, from a plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table;

[0278] The prediction module 703 is used to call a pre-trained abnormal behavior prediction model and obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data;

[0279] Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data associated with multiple sample objects respectively; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation method.

[0280] In one embodiment, the device may also include a construction module, which is used to: obtain multiple sample indicator data respectively associated with multiple sample objects; for the multiple sample indicator data associated with each sample object, select multiple candidate sample indicators for abnormal behavior prediction from the indicators corresponding to the multiple sample indicator data; perform membership division on the multiple candidate sample indicators to obtain the membership value corresponding to each candidate sample indicator, and based on the membership value corresponding to each candidate sample indicator, determine multiple target sample indicators from the multiple candidate sample indicators; perform standardization on the multiple target sample indicator data corresponding to the multiple target sample indicators to obtain multiple standard sample indicator data; and construct a sample indicator data table based on the multiple standard sample indicator data corresponding to each sample object.

[0281] In one embodiment, when the construction module is used to determine multiple target sample indicators from multiple candidate sample indicators based on the membership value corresponding to each candidate sample indicator and the hierarchical analysis method, it is specifically used to: use the hierarchical analysis method to determine the initial weight corresponding to each candidate sample indicator; for each candidate sample indicator, based on the initial weight and the membership value corresponding to the candidate sample indicator, determine the standard weighted weight corresponding to the candidate sample indicator; from the multiple candidate sample indicators, select multiple candidate sample indicators whose standard weighted weight is greater than a preset standard weighted weight threshold as multiple target sample indicators.

[0282] In one embodiment, when the construction module is used to select multiple candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the multiple sample indicator data associated with each sample object, it is specifically used to: for the multiple sample indicator data associated with each sample object, based on the association parameters corresponding to the abnormal behavior to be predicted, select multiple candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the multiple sample indicator data.

[0283] In one embodiment, the device may further include a training and testing module. The number of sample objects is N, where N is a positive integer. The construction module is further configured to determine the weighted Gini coefficient of the indicator corresponding to each target sample indicator data based on the multiple target sample indicator data corresponding to each of the X sample objects; X is a positive integer less than N; a decision tree model is constructed based on the weighted Gini coefficient of each indicator; the training and testing module is configured to train the decision tree model based on each target sample indicator data to obtain a trained decision tree model; the trained decision tree model is tested based on the multiple target sample indicator data corresponding to each of the Y sample objects, and when the test result indicates that the test has passed, the tested decision tree model is used as an abnormal behavior prediction model; wherein, Y+X=N.

[0284] In one embodiment, when the prediction module 703 is used to call a pre-trained abnormal behavior prediction model and obtain an abnormal behavior prediction result corresponding to the object to be tested based on multiple first indicator data, it is specifically used to: standardize the multiple first indicator data respectively to obtain multiple second indicator data; input the multiple second indicator data into the pre-trained abnormal behavior prediction model to obtain the abnormal behavior prediction result corresponding to the object to be tested.

[0285] Each module in the abnormal behavior prediction device described above can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0286] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal device, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via wired or wireless means, and the wireless means can be implemented via Wi-Fi, a mobile cellular network, near-field communication (NFC), or other technologies. When executed by the processor, the computer program implements a method for predicting abnormal behavior. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0287] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0288] In an exemplary embodiment, the present application provides a computer device including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned abnormal behavior prediction method when executing the computer program.

[0289] In an exemplary embodiment, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above-mentioned abnormal behavior prediction method when the computer program is executed by a processor.

[0290] In an exemplary embodiment, the present application provides a computer program product, including a computer program, which implements the steps in the above abnormal behavior prediction method when executed by a processor.

[0291] It should be noted that the data involved in this application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0292] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0293] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0294] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for predicting abnormal behavior, characterized in that: The method comprises: Obtain multiple indicator data associated with the object to be measured; Selecting, from the plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table; Calling a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on the plurality of first indicator data; Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data respectively associated with multiple sample objects; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table by adopting feature segmentation.

2. The method according to claim 1, characterized in that The method further comprises: Acquire a plurality of sample indicator data respectively associated with a plurality of the sample objects; For the plurality of sample indicator data associated with each of the sample objects, selecting a plurality of candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the plurality of sample indicator data; Performing membership division on the plurality of candidate sample indicators to obtain a membership value corresponding to each candidate sample indicator, and determining a plurality of target sample indicators from the plurality of candidate sample indicators based on the membership value corresponding to each candidate sample indicator; performing standardization processing on the target sample indicator data corresponding to the target sample indicators to obtain a plurality of standard sample indicator data; The sample indicator data table is constructed based on the plurality of standard sample indicator data corresponding to each sample object.

3. The method according to claim 2, characterized in that The step of determining a plurality of target sample indicators from the plurality of candidate sample indicators based on the membership value corresponding to each candidate sample indicator includes: Using the hierarchical analysis method, determining the initial weight corresponding to each candidate sample indicator; For each candidate sample indicator, determining a standard weighted weight corresponding to the candidate sample indicator based on the initial weight corresponding to the candidate sample indicator and the membership value; From the plurality of candidate sample indices, a plurality of candidate sample indices whose standard weighted weights are greater than a preset standard weighted weight threshold are selected as a plurality of target sample indices.

4. The method according to claim 2, characterized in that The selecting, for each of the sample objects, a plurality of sample indicator data associated with the sample objects, a plurality of candidate sample indicators for abnormal behavior prediction from the indicators respectively corresponding to the plurality of sample indicator data, including: For the plurality of sample indicator data associated with each of the sample objects, based on the associated parameters corresponding to the abnormal behavior to be predicted, a plurality of candidate sample indicators for abnormal behavior prediction are selected from the indicators respectively corresponding to the plurality of sample indicator data.

5. The method according to any one of claims 1 to 4, characterized in that The number of the sample objects is N, where N is a positive integer; and the method further includes: Based on a plurality of target sample indicator data corresponding to each of the X sample objects, determining a weighted Gini coefficient of an indicator corresponding to each of the target sample indicator data; X is a positive integer less than N; Constructing a decision tree model based on the weighted Gini coefficient of each of the indicators; Training the decision tree model based on each target sample indicator data to obtain a trained decision tree model; Based on the multiple target sample indicator data corresponding to the Y sample objects, the trained decision tree model is tested, and when the test result indicates that the test passes, the tested decision tree model is used as the abnormal behavior prediction model; wherein Y+X=N.

6. The method according to claim 1, characterized in that The calling of a pre-trained abnormal behavior prediction model to obtain an abnormal behavior prediction result corresponding to the object to be tested based on the plurality of first indicator data includes: performing standardization processing on the plurality of first indicator data respectively to obtain a plurality of second indicator data; Input the plurality of second indicator data into a pre-trained abnormal behavior prediction model to obtain abnormal behavior prediction results corresponding to the object to be tested.

7. An abnormal behavior prediction device, characterized in that: The device comprises: An acquisition module, used to acquire multiple indicator data associated with the object to be measured; A selection module is configured to select, from the plurality of indicator data, a plurality of first indicator data having the same indicators as those corresponding to the sample indicator data in the pre-constructed sample indicator data table; A prediction module, configured to call a pre-trained abnormal behavior prediction model and obtain an abnormal behavior prediction result corresponding to the object to be tested based on a plurality of the first indicator data; Among them, the sample indicator data table is constructed by analyzing multiple sample indicator data respectively associated with multiple sample objects; the abnormal behavior prediction model is constructed and trained based on multiple target sample indicator data corresponding to multiple sample objects included in the sample indicator data table using a feature segmentation method, and the abnormal behavior prediction model is a model that does not require assumptions about data distribution.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images